timing attacks are unlikely to be an issue here, CSRF tokens are particular to the session, not server side.  The CSRF attacker doesn't have the ability to see the requests and time their responses unless you're talking about a fairly specific set of scenarios like an active MITM attacker.  I'd love to seem someone demo that as it'd be quite a neat trick, but seems an unlikely vector at present.

We could change it, but it'd be belt-and-suspenders style stuff not a critical fix.